Network Configuration, Troubleshooting, and Debugging Tools ifconfig Command

16. NSLookup Command
Nslookup is also a popular command-line utility to query DNS servers both interactively and non-interactively. It is used to query DNS resource records (RR). You can find out the “A” record (IP address) of a domain as shown.
$ nslookup google.com

Server: 192.168.0.1

Address: 192.168.0.1#53

Non-authoritative answer:

Name: google.com
Address: 172.217.166.78
You can also perform a reverse domain lookup as shown.
$ nslookup 216.58.208.174

Server: 192.168.0.1

Address: 192.168.0.1#53

Non-authoritative answer:

174.208.58.216.in-addr.arpa name = lhr25s09-in-f14.1e100.net.
174.208.58.216.in-addr.arpa name = lhr25s09-in-f174.1e100.net.

Authoritative answers can be found from:

in-addr.arpa nameserver = e.in-addr-servers.arpa.
in-addr.arpa nameserver = f.in-addr-servers.arpa.
in-addr.arpa nameserver = a.in-addr-servers.arpa.
in-addr.arpa nameserver = b.in-addr-servers.arpa.
in-addr.arpa nameserver = c.in-addr-servers.arpa.
in-addr.arpa nameserver = d.in-addr-servers.arpa.
a.in-addr-servers.arpa internet address = 199.180.182.53
b.in-addr-servers.arpa internet address = 199.253.183.183
c.in-addr-servers.arpa internet address = 196.216.169.10
d.in-addr-servers.arpa internet address = 200.10.60.53
e.in-addr-servers.arpa internet address = 203.119.86.101
f.in-addr-servers.arpa internet address = 193.0.9.1
Linux Network Packet Analyzers
17. Tcpdump Command
Tcpdump is a very powerful and widely used command-line network sniffer. It is used to capture and analyze TCP/IP packets transmitted or received over a network on a specific interface.
To capture packets from a given interface, specify it using the -i option.
$ tcpdump -i eth1

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on enp0s3, link-type EN10MB (Ethernet), capture size 262144 bytes
09:35:40.287439 IP tecmint.com.ssh > 192.168.0.103.36398: Flags [P.], seq 4152360356:4152360552, ack 306922699, win 270, options [nop,nop,TS val 2211778668 ecr 2019055], length 196
09:35:40.287655 IP 192.168.0.103.36398 > tecmint.com.ssh: Flags [.], ack 196, win 5202, options [nop,nop,TS val 2019058 ecr 2211778668], length 0
09:35:40.288269 IP tecmint.com.54899 > gateway.domain: 43760+ PTR? 103.0.168.192.in-addr.arpa. (44)
09:35:40.333763 IP gateway.domain > tecmint.com.54899: 43760 NXDomain* 0/1/0 (94)
09:35:40.335311 IP tecmint.com.52036 > gateway.domain: 44289+ PTR? 1.0.168.192.in-addr.arpa. (42)
To capture a specific number of packets, use the -c option to enter the desired number.
$ tcpdump -c 5 -i eth1
You can also capture and save packets to a file for later analysis, use the -w flag to specify the output file.
$ tcpdump -w captured.pacs -i eth1